feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/billing/stripe.go

@@ -0,0 +1,157 @@
+package billing
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/stripe/stripe-go/v82"
+	"github.com/stripe/stripe-go/v82/billingportal/session"
+	csession "github.com/stripe/stripe-go/v82/checkout/session"
+	"github.com/stripe/stripe-go/v82/customer"
+	"github.com/stripe/stripe-go/v82/webhook"
+)
+
+// Client wraps the Stripe SDK with the subset of calls the API needs.
+// Concentrates env-var reads + price-ID lookups in one place so handlers
+// stay focused on HTTP, not Stripe plumbing.
+type Client struct {
+	secretKey     string
+	webhookSecret string
+	prices        map[Tier]string
+}
+
+// Config is the env-derived configuration the Client needs.
+type Config struct {
+	SecretKey       string
+	WebhookSecret   string
+	PriceProMonthly string
+	PriceBusiness   string
+}
+
+// NewClient validates required fields and returns a configured client.
+// Returns (nil, nil) when SecretKey is empty — callers treat that as
+// "billing disabled" and degrade gracefully (free tier for everyone, no
+// /billing/* endpoints exposed).
+func NewClient(cfg Config) (*Client, error) {
+	if cfg.SecretKey == "" {
+		return nil, nil
+	}
+	stripe.Key = cfg.SecretKey
+
+	c := &Client{
+		secretKey:     cfg.SecretKey,
+		webhookSecret: cfg.WebhookSecret,
+		prices: map[Tier]string{
+			TierPro:      cfg.PriceProMonthly,
+			TierBusiness: cfg.PriceBusiness,
+		},
+	}
+	return c, nil
+}
+
+// Enabled reports whether the client was constructed with a Stripe key.
+func (c *Client) Enabled() bool { return c != nil && c.secretKey != "" }
+
+// PriceFor returns the Stripe Price ID for a tier or an error if it
+// hasn't been configured — checkout will fail loudly rather than
+// silently send the customer to an empty checkout page.
+func (c *Client) PriceFor(tier Tier) (string, error) {
+	id, ok := c.prices[tier]
+	if !ok || id == "" {
+		return "", fmt.Errorf("billing: no Stripe price configured for tier %q", tier)
+	}
+	return id, nil
+}
+
+// CreateOrGetCustomer returns the Stripe customer id for the given
+// (user_id, email). If `existingID` is non-empty we trust it; otherwise
+// we create a new Stripe customer and let the caller persist the id.
+func (c *Client) CreateOrGetCustomer(userID, email, name, existingID string) (string, error) {
+	if !c.Enabled() {
+		return "", errors.New("billing: disabled")
+	}
+	if existingID != "" {
+		return existingID, nil
+	}
+	params := &stripe.CustomerParams{
+		Email:    stripe.String(email),
+		Name:     stripe.String(name),
+		Metadata: map[string]string{"gg_user_id": userID},
+	}
+	cust, err := customer.New(params)
+	if err != nil {
+		return "", fmt.Errorf("stripe customer create: %w", err)
+	}
+	return cust.ID, nil
+}
+
+// CheckoutSessionParams collects the inputs CreateCheckoutSession needs.
+// Keeping them in a struct so future fields (coupon codes, trial periods,
+// referral metadata) drop in without breaking callers.
+type CheckoutSessionParams struct {
+	CustomerID string
+	PriceID    string
+	SuccessURL string
+	CancelURL  string
+}
+
+// CreateCheckoutSession returns the URL the frontend redirects the user
+// to. Subscription mode — recurring billing for Pro/Business.
+func (c *Client) CreateCheckoutSession(p CheckoutSessionParams) (string, error) {
+	if !c.Enabled() {
+		return "", errors.New("billing: disabled")
+	}
+	params := &stripe.CheckoutSessionParams{
+		Mode:       stripe.String(string(stripe.CheckoutSessionModeSubscription)),
+		Customer:   stripe.String(p.CustomerID),
+		SuccessURL: stripe.String(p.SuccessURL),
+		CancelURL:  stripe.String(p.CancelURL),
+		LineItems: []*stripe.CheckoutSessionLineItemParams{{
+			Price:    stripe.String(p.PriceID),
+			Quantity: stripe.Int64(1),
+		}},
+		AllowPromotionCodes: stripe.Bool(true),
+	}
+	sess, err := csession.New(params)
+	if err != nil {
+		return "", fmt.Errorf("stripe checkout session: %w", err)
+	}
+	return sess.URL, nil
+}
+
+// CreatePortalSession returns a URL to the Stripe-hosted customer
+// portal so the user can manage payment methods, cancel, view invoices.
+func (c *Client) CreatePortalSession(customerID, returnURL string) (string, error) {
+	if !c.Enabled() {
+		return "", errors.New("billing: disabled")
+	}
+	params := &stripe.BillingPortalSessionParams{
+		Customer:  stripe.String(customerID),
+		ReturnURL: stripe.String(returnURL),
+	}
+	sess, err := session.New(params)
+	if err != nil {
+		return "", fmt.Errorf("stripe portal session: %w", err)
+	}
+	return sess.URL, nil
+}
+
+// VerifyWebhook validates the Stripe signature header and returns the
+// parsed event. Refuses to verify when no webhook secret is configured —
+// no shared secret means anyone can POST forged events, so the route
+// should reject everything in that case (the caller does that check).
+//
+// We pass IgnoreAPIVersionMismatch because Stripe accounts can be on a
+// newer API version than the SDK we're built against. Event payloads
+// are designed to be forward-compatible — the SDK warns about the skew
+// but the deserialised event is still safe to use. Strict matching
+// would mean we'd have to upgrade the SDK in lockstep with whatever
+// Stripe rolls out, defeating the point of having an SDK.
+func (c *Client) VerifyWebhook(body []byte, sigHeader string) (stripe.Event, error) {
+	if c.webhookSecret == "" {
+		return stripe.Event{}, errors.New("billing: no webhook secret configured")
+	}
+	return webhook.ConstructEventWithOptions(body, sigHeader, c.webhookSecret, webhook.ConstructEventOptions{
+		IgnoreAPIVersionMismatch: true,
+	})
+}

internal/billing/tiers.go

@@ -0,0 +1,73 @@
+// Package billing models GuestGuard's subscription tiers and Stripe
+// integration. Plan limits live here so handler + middleware layers don't
+// hard-code numbers — change a value, restart the API, and the cap moves.
+package billing
+
+import "fmt"
+
+// Tier is the user's current subscription tier. Stored as text in the
+// subscriptions table.
+type Tier string
+
+const (
+	TierFree     Tier = "free"
+	TierPro      Tier = "pro"
+	TierBusiness Tier = "business"
+)
+
+func (t Tier) Valid() bool {
+	switch t {
+	case TierFree, TierPro, TierBusiness:
+		return true
+	}
+	return false
+}
+
+// Limits enforces what a tier may do. -1 means unlimited.
+type Limits struct {
+	EventsPerMonth int
+	GuestsPerEvent int
+}
+
+// TierLimits is the canonical plan-limits table. Matches docs/TIER1_PLAN.md
+// Block F pricing (placeholder until market validation).
+var TierLimits = map[Tier]Limits{
+	TierFree:     {EventsPerMonth: 1, GuestsPerEvent: 50},
+	TierPro:      {EventsPerMonth: 10, GuestsPerEvent: 1000},
+	TierBusiness: {EventsPerMonth: -1, GuestsPerEvent: 5000},
+}
+
+// LimitsFor returns the limits for a tier, defaulting to Free for unknown
+// strings — defensive, so a typo or future-tier in the DB never grants
+// unlimited access.
+func LimitsFor(t Tier) Limits {
+	if l, ok := TierLimits[t]; ok {
+		return l
+	}
+	return TierLimits[TierFree]
+}
+
+// StatusGrantsAccess returns true if a subscription with this status
+// should be treated as paid. Mirrors the unique-index predicate in
+// 0005_billing.up.sql.
+func StatusGrantsAccess(status string) bool {
+	switch status {
+	case "active", "past_due", "trialing":
+		return true
+	}
+	return false
+}
+
+// LimitError describes a denied-by-policy outcome. The handler layer
+// turns this into a 402 with a JSON body the frontend uses to render
+// the upgrade modal.
+type LimitError struct {
+	Reason string
+	Tier   Tier
+	Limit  int
+	Used   int
+}
+
+func (e *LimitError) Error() string {
+	return fmt.Sprintf("billing: %s (tier=%s used=%d limit=%d)", e.Reason, e.Tier, e.Used, e.Limit)
+}